SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/hipaa-audit-controls-required

What do HIPAA audit controls require?

Hardware, software, or procedures that record and examine activity in systems with ePHI.

Start playing free

  1. Record and examine activity in systems containing ePHI ✔
  2. Encrypt all backups
  3. Assign unique IDs

Why: Audit controls are required and must record and examine activity in information systems that contain or use ePHI.

Huh, didn't know that: Audit logs can help investigate suspicious access or tampering.

The dad joke
Why did the audit log become a detective? It loved recording and examining activity.
Like this card?
Play the game

References

Answer: Record and examine activity in systems containing ePHI. Audit controls are required and must record and examine activity in information systems that contain or use ePHI.

  1. 45 CFR 164.312(b) www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.312
    Implement hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use electronic protected health information.
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Work SkillsWhat is electronic protected health information, or ePHI?Work SkillsWho must comply with the HIPAA Security Rule?Work SkillsWhat are administrative safeguards in the HIPAA Security Rule?

That's stuff everyone should know.